Vulnerability-Lookup

GHSA-PVGV-GCP7-V38G

Vulnerability from github – Published: 2026-10-09 17:07 – Updated: 2026-10-09 17:07

Summary

Nginx UI: Node Secret Credential Exposure via URL Query Parameter

Details

1. Vulnerability Summary

nginx-ui's Node.Secret is a master credential that bypasses all JWT/password authentication for the entire API. The application accepts this credential via a URL query parameter (?node_secret=), causing it to be recorded in plaintext in HTTP access logs, reverse proxy logs, browser history, and HTTP Referer headers. Additionally, the official cluster configuration format embeds node secrets directly into URL query strings stored in app.ini and environment variables, creating a systemic credential exposure pattern across the entire cluster deployment model.

An attacker who gains read access to any log aggregation system, proxy log, or configuration file can extract the node secret and obtain full, persistent, unauthenticated administrative access to the nginx-ui API — including reading TLS private keys, modifying nginx configurations, and (when chained with Bug #1) achieving OS-level code execution.

2. Root Cause Analysis

2.1 Node Secret Accepted as URL Query Parameter

The getNodeSecret function reads the credential from the URL query string as a fallback when the X-Node-Secret header is absent: 1

This function is called in both AuthRequired() and AuthRequiredWS() middleware, meaning the query parameter bypass works for all authenticated HTTP and WebSocket endpoints: 2 3

The same pattern is repeated in the WebSocket origin checker, which also reads node_secret from the URL: 4

2.2 Node Secret Is a Full Authentication Bypass

The documentation explicitly states this is by design: 5

When the secret matches, the middleware sets the request context to an admin-level init user and calls c.Next() — bypassing all JWT validation, session checks, and 2FA: 2

2.3 Cluster Configuration Embeds Node Secrets in URLs

The official cluster configuration format, documented and used in app.example.ini, stores node secrets as URL query parameters: 6

The parseNodeUrl function extracts the secret from the URL's query string and stores it in the database as the node's Token field: 7

This means node secrets are embedded in: - app.ini on disk (readable by any process with filesystem access) - The NGINX_UI_CLUSTER_NODE environment variable (visible in ps aux, Docker inspect, Kubernetes pod specs, CI/CD logs) - The SQLite database nodes table as the token column in plaintext

2.4 Node Secret Generation Uses UUID

The secret is auto-generated as a UUID v4 if not set: 8

UUID v4 has 122 bits of entropy, which is adequate. However, the exposure surface described in this report makes entropy irrelevant — the secret is leaked through operational channels, not brute-forced.

3. Exposure Surface

The following table maps each exposure vector to its source in the codebase:

Vector	How It Happens	Who Can See It
HTTP access logs	`GET /api/settings?node_secret=xxx` logged by nginx/caddy/apache	Log readers, SIEM operators
Application logs	Gin debug mode logs full request URLs	Server operators, log aggregators
Browser history	Admin uses `?node_secret=` URL directly	Anyone with browser access
HTTP Referer header	Page with `?node_secret=` in URL links to external resource	Third-party servers
WebSocket URL logs	`ws://host/api/ws?node_secret=xxx` logged by proxies	Proxy log readers
`app.ini` on disk	Cluster node URLs contain `node_secret=`	Filesystem readers
Environment variables	`NGINX_UI_CLUSTER_NODE=...&node_secret=...`	`ps aux`, Docker inspect, K8s pod specs
CI/CD pipeline logs	Env vars printed during deployment	CI/CD log viewers
Database	`nodes.token` column stored in plaintext SQLite	DB file readers

4. Proof of Concept

Scenario A: Log-Based Secret Extraction

Step 1 — Attacker gains read access to nginx access logs (e.g., via a misconfigured log aggregator, a compromised monitoring account, or a separate vulnerability).

Step 2 — Search logs for the pattern:

grep -oP 'node_secret=[^&\s"]+' /var/log/nginx/access.log
# Output: node_secret=a1b2c3d4-e5f6-7890-abcd-ef1234567890

Step 3 — Use the extracted secret for full API access:

GET /api/settings HTTP/1.1
Host: target:9000
X-Node-Secret: a1b2c3d4-e5f6-7890-abcd-ef1234567890

Response: Full settings JSON including JwtSecret, NodeSecret, all nginx paths, and all configured credentials.

GET /api/nginx/config?filepath=/etc/nginx/nginx.conf HTTP/1.1
Host: target:9000
X-Node-Secret: a1b2c3d4-e5f6-7890-abcd-ef1234567890

Response: Full nginx configuration including any embedded credentials.

Scenario B: Environment Variable Exposure in Docker/Kubernetes

Step 1 — Attacker reads a Kubernetes pod spec or Docker Compose file:

environment:
  - NGINX_UI_CLUSTER_NODE=http://10.0.0.1:9000?name=node1&node_secret=my-node-secret&enabled=true

Step 2 — Extract the secret from the URL query string.

Step 3 — Authenticate to the target node:

POST /api/nginx/test HTTP/1.1
Host: 10.0.0.1:9000
X-Node-Secret: my-node-secret

The attacker now has full admin access to the cluster node.

Scenario C: Referer Header Leak to Third-Party

Step 1 — Admin navigates to a page with ?node_secret= in the URL.

Step 2 — That page contains a resource (image, script, analytics) from a third-party domain.

Step 3 — Browser sends:

GET /analytics.js HTTP/1.1
Host: analytics.third-party.com
Referer: https://nginx-ui.internal/api/settings?node_secret=a1b2c3d4-...

The third-party server receives the node secret in the Referer header.

5. Impact

Confidentiality: Full read access to all nginx configurations, TLS private keys, ACME account credentials, database contents, and all settings stored in app.ini.
Integrity: Full write access to all nginx configurations across all cluster nodes. An attacker can deploy malicious nginx configs, disable TLS, or redirect traffic.
Availability: An attacker can reload or restart nginx with a broken configuration, causing a denial of service.
Persistence: The node secret does not expire and has no revocation mechanism. Once leaked, it provides permanent access until manually rotated.
Cluster-wide blast radius: A single leaked node secret from one cluster member's logs can be used to authenticate to any other node that shares the same secret.

6. Affected Versions

All versions of nginx-ui where getNodeSecret reads from c.Query("node_secret"). Present in the current dev branch. The cluster URL format with embedded node_secret has been present since v2.0.0-beta.23.

7. Recommended Fixes

Fix 1 (Primary) — Remove query parameter support for node_secret:

// internal/middleware/middleware.go
func getNodeSecret(c *gin.Context) (secret string) {
    // Only accept via header, never via query parameter
    return c.GetHeader("X-Node-Secret")
}

Apply the same change to isTrustedNodeRequest in websocket_origin.go.

Fix 2 — Redesign cluster node configuration format:

The cluster node URL format must not embed secrets in query parameters. Use a separate configuration key:

[cluster]
Node     = http://10.0.0.1:9000?name=node1&enabled=true
NodeKey1 = <secret-for-node1>

Or store secrets in a separate secrets file with restricted permissions.

Fix 3 — Encrypt node tokens at rest:

The nodes.token column in the SQLite database stores secrets in plaintext. Encrypt using the CryptoSettings.Secret key before storage.

Fix 4 — Add secret rotation support:

Provide an API endpoint to rotate the Node.Secret and invalidate all existing sessions authenticated via the old secret.

8. Timeline

Date	Event
2026-04-21	Vulnerability identified via source code review
—	Vendor notification (pending)
—	CVE assignment (pending)

Citations

File: internal/middleware/middleware.go (L73-80)

// getNodeSecret from header or query
func getNodeSecret(c *gin.Context) (secret string) {
    if secret = c.GetHeader("X-Node-Secret"); secret != "" {
        return secret
    }

    return c.Query("node_secret")
}

File: internal/middleware/middleware.go (L96-103)

        // Check node secret authentication
        if nodeSecret := getNodeSecret(c); nodeSecret != "" && nodeSecret == settings.NodeSettings.Secret {
            initUser := user.GetInitUser(c)
            c.Set("Secret", nodeSecret)
            c.Set("user", initUser)
            c.Next()
            return
        }

File: internal/middleware/middleware.go (L152-158)

        if nodeSecret := getNodeSecret(c); nodeSecret != "" && nodeSecret == settings.NodeSettings.Secret {
            initUser := user.GetInitUser(c)
            c.Set("Secret", nodeSecret)
            c.Set("user", initUser)
            c.Next()
            return
        }

File: internal/middleware/websocket_origin.go (L39-46)

func isTrustedNodeRequest(r *http.Request) bool {
    secret := strings.TrimSpace(r.Header.Get("X-Node-Secret"))
    if secret == "" {
        secret = strings.TrimSpace(r.URL.Query().Get("node_secret"))
    }

    return secret != "" && secret == settings.NodeSettings.Secret
}

File: docs/guide/config-server.md (L109-111)

This secret is used to authenticate the communication between the Nginx UI servers.
Also, you can use this secret to access the Nginx UI API without a password.

File: app.example.ini (L45-48)

[cluster]
Node = http://10.0.0.1:9000?name=node1&node_secret=my-node-secret&enabled=true
Node = http://10.0.0.2:9000?name=node2&node_secret=my-node-secret&enabled=true
Node = http://10.0.0.3?name=node3&node_secret=my-node-secret&enabled=true

File: internal/cluster/cluster.go (L55-73)

func parseNodeUrl(nodeUrl string) (node *model.Node, err error) {
    u, err := url.Parse(nodeUrl)
    if err != nil {
        return
    }
    var sb strings.Builder
    sb.WriteString(u.Scheme)
    sb.WriteString("://")
    sb.WriteString(u.Host)
    sb.WriteString(u.Path)

    node = &model.Node{
        Name:    u.Query().Get("name"),
        URL:     sb.String(),
        Token:   u.Query().Get("node_secret"),
        Enabled: u.Query().Get("enabled") == "true",
    }

    return

File: internal/kernel/boot.go (L132-144)

func InitNodeSecret() {
    if settings.NodeSettings.Secret == "" {
        logger.Info("Secret is empty, generating...")
        uuidStr := uuid.New().String()
        err := settings.Update(func() {
            settings.NodeSettings.Secret = uuidStr
        })
        if err != nil {
            logger.Error("Error save settings", err)
        }
        logger.Info("Generated Secret: ", uuidStr)
    }
}

Severity

8.8 (High)


                  
                    CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "Go",
        "name": "github.com/0xJacky/Nginx-UI"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "1.9.10-0.20250517140552-daee3ac7ade1"
            },
            {
              "fixed": "1.9.10-0.20260728074433-a3999bd78a3b"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-107807"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-312",
      "CWE-598"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-10-09T17:07:09Z",
    "nvd_published_at": null,
    "severity": "HIGH"
  },
  "details": "## 1. Vulnerability Summary\n\nnginx-ui\u0027s `Node.Secret` is a master credential that bypasses all JWT/password authentication for the entire API. The application accepts this credential via a **URL query parameter** (`?node_secret=`), causing it to be recorded in plaintext in HTTP access logs, reverse proxy logs, browser history, and HTTP `Referer` headers. Additionally, the official cluster configuration format embeds node secrets directly into URL query strings stored in `app.ini` and environment variables, creating a systemic credential exposure pattern across the entire cluster deployment model.\n\nAn attacker who gains read access to any log aggregation system, proxy log, or configuration file can extract the node secret and obtain full, persistent, unauthenticated administrative access to the nginx-ui API \u2014 including reading TLS private keys, modifying nginx configurations, and (when chained with Bug #1) achieving OS-level code execution.\n\n---\n\n## 2. Root Cause Analysis\n\n### 2.1 Node Secret Accepted as URL Query Parameter\n\nThe `getNodeSecret` function reads the credential from the URL query string as a fallback when the `X-Node-Secret` header is absent: [1](#3-0) \n\nThis function is called in both `AuthRequired()` and `AuthRequiredWS()` middleware, meaning the query parameter bypass works for **all authenticated HTTP and WebSocket endpoints**: [2](#3-1) [3](#3-2) \n\nThe same pattern is repeated in the WebSocket origin checker, which also reads `node_secret` from the URL: [4](#3-3) \n\n### 2.2 Node Secret Is a Full Authentication Bypass\n\nThe documentation explicitly states this is by design: [5](#3-4) \n\nWhen the secret matches, the middleware sets the request context to an admin-level init user and calls `c.Next()` \u2014 bypassing all JWT validation, session checks, and 2FA: [2](#3-1) \n\n### 2.3 Cluster Configuration Embeds Node Secrets in URLs\n\nThe official cluster configuration format, documented and used in `app.example.ini`, stores node secrets as URL query parameters: [6](#3-5) \n\nThe `parseNodeUrl` function extracts the secret from the URL\u0027s query string and stores it in the database as the node\u0027s `Token` field: [7](#3-6) \n\nThis means node secrets are embedded in:\n- `app.ini` on disk (readable by any process with filesystem access)\n- The `NGINX_UI_CLUSTER_NODE` environment variable (visible in `ps aux`, Docker inspect, Kubernetes pod specs, CI/CD logs)\n- The SQLite database `nodes` table as the `token` column in plaintext\n\n### 2.4 Node Secret Generation Uses UUID\n\nThe secret is auto-generated as a UUID v4 if not set: [8](#3-7) \n\nUUID v4 has 122 bits of entropy, which is adequate. However, the exposure surface described in this report makes entropy irrelevant \u2014 the secret is leaked through operational channels, not brute-forced.\n\n---\n\n## 3. Exposure Surface\n\nThe following table maps each exposure vector to its source in the codebase:\n\n| Vector | How It Happens | Who Can See It |\n|---|---|---|\n| **HTTP access logs** | `GET /api/settings?node_secret=xxx` logged by nginx/caddy/apache | Log readers, SIEM operators |\n| **Application logs** | Gin debug mode logs full request URLs | Server operators, log aggregators |\n| **Browser history** | Admin uses `?node_secret=` URL directly | Anyone with browser access |\n| **HTTP Referer header** | Page with `?node_secret=` in URL links to external resource | Third-party servers |\n| **WebSocket URL logs** | `ws://host/api/ws?node_secret=xxx` logged by proxies | Proxy log readers |\n| **`app.ini` on disk** | Cluster node URLs contain `node_secret=` | Filesystem readers |\n| **Environment variables** | `NGINX_UI_CLUSTER_NODE=...\u0026node_secret=...` | `ps aux`, Docker inspect, K8s pod specs |\n| **CI/CD pipeline logs** | Env vars printed during deployment | CI/CD log viewers |\n| **Database** | `nodes.token` column stored in plaintext SQLite | DB file readers |\n\n---\n\n## 4. Proof of Concept\n\n### Scenario A: Log-Based Secret Extraction\n\n**Step 1 \u2014 Attacker gains read access to nginx access logs** (e.g., via a misconfigured log aggregator, a compromised monitoring account, or a separate vulnerability).\n\n**Step 2 \u2014 Search logs for the pattern:**\n\n```bash\ngrep -oP \u0027node_secret=[^\u0026\\s\"]+\u0027 /var/log/nginx/access.log\n# Output: node_secret=a1b2c3d4-e5f6-7890-abcd-ef1234567890\n```\n\n**Step 3 \u2014 Use the extracted secret for full API access:**\n\n```http\nGET /api/settings HTTP/1.1\nHost: target:9000\nX-Node-Secret: a1b2c3d4-e5f6-7890-abcd-ef1234567890\n```\n\nResponse: Full settings JSON including `JwtSecret`, `NodeSecret`, all nginx paths, and all configured credentials.\n\n```http\nGET /api/nginx/config?filepath=/etc/nginx/nginx.conf HTTP/1.1\nHost: target:9000\nX-Node-Secret: a1b2c3d4-e5f6-7890-abcd-ef1234567890\n```\n\nResponse: Full nginx configuration including any embedded credentials.\n\n### Scenario B: Environment Variable Exposure in Docker/Kubernetes\n\n**Step 1 \u2014 Attacker reads a Kubernetes pod spec or Docker Compose file:**\n\n```yaml\nenvironment:\n  - NGINX_UI_CLUSTER_NODE=http://10.0.0.1:9000?name=node1\u0026node_secret=my-node-secret\u0026enabled=true\n```\n\n**Step 2 \u2014 Extract the secret from the URL query string.**\n\n**Step 3 \u2014 Authenticate to the target node:**\n\n```http\nPOST /api/nginx/test HTTP/1.1\nHost: 10.0.0.1:9000\nX-Node-Secret: my-node-secret\n```\n\nThe attacker now has full admin access to the cluster node.\n\n### Scenario C: Referer Header Leak to Third-Party\n\n**Step 1 \u2014 Admin navigates to a page with `?node_secret=` in the URL.**\n\n**Step 2 \u2014 That page contains a resource (image, script, analytics) from a third-party domain.**\n\n**Step 3 \u2014 Browser sends:**\n\n```http\nGET /analytics.js HTTP/1.1\nHost: analytics.third-party.com\nReferer: https://nginx-ui.internal/api/settings?node_secret=a1b2c3d4-...\n```\n\nThe third-party server receives the node secret in the `Referer` header.\n\n\n\n---\n\n## 5. Impact\n\n- **Confidentiality:** Full read access to all nginx configurations, TLS private keys, ACME account credentials, database contents, and all settings stored in `app.ini`.\n- **Integrity:** Full write access to all nginx configurations across all cluster nodes. An attacker can deploy malicious nginx configs, disable TLS, or redirect traffic.\n- **Availability:** An attacker can reload or restart nginx with a broken configuration, causing a denial of service.\n- **Persistence:** The node secret does not expire and has no revocation mechanism. Once leaked, it provides permanent access until manually rotated.\n- **Cluster-wide blast radius:** A single leaked node secret from one cluster member\u0027s logs can be used to authenticate to any other node that shares the same secret.\n\n---\n\n## 6. Affected Versions\n\nAll versions of nginx-ui where `getNodeSecret` reads from `c.Query(\"node_secret\")`. Present in the current `dev` branch. The cluster URL format with embedded `node_secret` has been present since `v2.0.0-beta.23`.\n\n---\n\n## 7. Recommended Fixes\n\n**Fix 1 (Primary) \u2014 Remove query parameter support for `node_secret`:**\n\n```go\n// internal/middleware/middleware.go\nfunc getNodeSecret(c *gin.Context) (secret string) {\n    // Only accept via header, never via query parameter\n    return c.GetHeader(\"X-Node-Secret\")\n}\n```\n\nApply the same change to `isTrustedNodeRequest` in `websocket_origin.go`.\n\n**Fix 2 \u2014 Redesign cluster node configuration format:**\n\nThe cluster node URL format must not embed secrets in query parameters. Use a separate configuration key:\n\n```ini\n[cluster]\nNode     = http://10.0.0.1:9000?name=node1\u0026enabled=true\nNodeKey1 = \u003csecret-for-node1\u003e\n```\n\nOr store secrets in a separate secrets file with restricted permissions.\n\n**Fix 3 \u2014 Encrypt node tokens at rest:**\n\nThe `nodes.token` column in the SQLite database stores secrets in plaintext. Encrypt using the `CryptoSettings.Secret` key before storage.\n\n**Fix 4 \u2014 Add secret rotation support:**\n\nProvide an API endpoint to rotate the `Node.Secret` and invalidate all existing sessions authenticated via the old secret.\n\n---\n\n## 8. Timeline\n\n| Date | Event |\n|---|---|\n| 2026-04-21 | Vulnerability identified via source code review |\n| \u2014 | Vendor notification (pending) |\n| \u2014 | CVE assignment (pending) |\n\n### Citations\n\n**File:** internal/middleware/middleware.go (L73-80)\n```go\n// getNodeSecret from header or query\nfunc getNodeSecret(c *gin.Context) (secret string) {\n\tif secret = c.GetHeader(\"X-Node-Secret\"); secret != \"\" {\n\t\treturn secret\n\t}\n\n\treturn c.Query(\"node_secret\")\n}\n```\n\n**File:** internal/middleware/middleware.go (L96-103)\n```go\n\t\t// Check node secret authentication\n\t\tif nodeSecret := getNodeSecret(c); nodeSecret != \"\" \u0026\u0026 nodeSecret == settings.NodeSettings.Secret {\n\t\t\tinitUser := user.GetInitUser(c)\n\t\t\tc.Set(\"Secret\", nodeSecret)\n\t\t\tc.Set(\"user\", initUser)\n\t\t\tc.Next()\n\t\t\treturn\n\t\t}\n```\n\n**File:** internal/middleware/middleware.go (L152-158)\n```go\n\t\tif nodeSecret := getNodeSecret(c); nodeSecret != \"\" \u0026\u0026 nodeSecret == settings.NodeSettings.Secret {\n\t\t\tinitUser := user.GetInitUser(c)\n\t\t\tc.Set(\"Secret\", nodeSecret)\n\t\t\tc.Set(\"user\", initUser)\n\t\t\tc.Next()\n\t\t\treturn\n\t\t}\n```\n\n**File:** internal/middleware/websocket_origin.go (L39-46)\n```go\nfunc isTrustedNodeRequest(r *http.Request) bool {\n\tsecret := strings.TrimSpace(r.Header.Get(\"X-Node-Secret\"))\n\tif secret == \"\" {\n\t\tsecret = strings.TrimSpace(r.URL.Query().Get(\"node_secret\"))\n\t}\n\n\treturn secret != \"\" \u0026\u0026 secret == settings.NodeSettings.Secret\n}\n```\n\n**File:** docs/guide/config-server.md (L109-111)\n```markdown\nThis secret is used to authenticate the communication between the Nginx UI servers.\nAlso, you can use this secret to access the Nginx UI API without a password.\n\n```\n\n**File:** app.example.ini (L45-48)\n```text\n[cluster]\nNode = http://10.0.0.1:9000?name=node1\u0026node_secret=my-node-secret\u0026enabled=true\nNode = http://10.0.0.2:9000?name=node2\u0026node_secret=my-node-secret\u0026enabled=true\nNode = http://10.0.0.3?name=node3\u0026node_secret=my-node-secret\u0026enabled=true\n```\n\n**File:** internal/cluster/cluster.go (L55-73)\n```go\nfunc parseNodeUrl(nodeUrl string) (node *model.Node, err error) {\n\tu, err := url.Parse(nodeUrl)\n\tif err != nil {\n\t\treturn\n\t}\n\tvar sb strings.Builder\n\tsb.WriteString(u.Scheme)\n\tsb.WriteString(\"://\")\n\tsb.WriteString(u.Host)\n\tsb.WriteString(u.Path)\n\n\tnode = \u0026model.Node{\n\t\tName:    u.Query().Get(\"name\"),\n\t\tURL:     sb.String(),\n\t\tToken:   u.Query().Get(\"node_secret\"),\n\t\tEnabled: u.Query().Get(\"enabled\") == \"true\",\n\t}\n\n\treturn\n```\n\n**File:** internal/kernel/boot.go (L132-144)\n```go\nfunc InitNodeSecret() {\n\tif settings.NodeSettings.Secret == \"\" {\n\t\tlogger.Info(\"Secret is empty, generating...\")\n\t\tuuidStr := uuid.New().String()\n\t\terr := settings.Update(func() {\n\t\t\tsettings.NodeSettings.Secret = uuidStr\n\t\t})\n\t\tif err != nil {\n\t\t\tlogger.Error(\"Error save settings\", err)\n\t\t}\n\t\tlogger.Info(\"Generated Secret: \", uuidStr)\n\t}\n}\n```",
  "id": "GHSA-pvgv-gcp7-v38g",
  "modified": "2026-10-09T17:07:09Z",
  "published": "2026-10-09T17:07:09Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/0xJacky/nginx-ui/security/advisories/GHSA-pvgv-gcp7-v38g"
    },
    {
      "type": "WEB",
      "url": "https://github.com/0xJacky/nginx-ui/commit/a3999bd78a3b97ab22e6b5e9fd478ac57598a954"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/0xJacky/nginx-ui"
    },
    {
      "type": "WEB",
      "url": "https://github.com/0xJacky/nginx-ui/releases/tag/v2.5.0"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Nginx UI: Node Secret Credential Exposure via URL Query Parameter"
}

CVE-2026-107807 (GCVE-0-2026-107807)

Vulnerability from cvelistv5 – Published: 2026-10-09 15:04 – Updated: 2026-10-09 17:57

Title

Nginx UI: Node Secret Credential Exposure via URL Query Parameter

Summary

Nginx UI is a web user interface for the Nginx web server. From 2.0.0 until 2.5.0, Nginx UI accepts the Node.Secret master credential through the node_secret query parameter in HTTP and WebSocket authentication paths instead of requiring the X-Node-Secret header. The credential can consequently appear in access logs, proxy logs, browser history, Referer headers, configuration URLs, and deployment environment data. A party that obtains the secret can bypass normal password, JWT, session, and second-factor checks and obtain persistent administrative API access, including access to configuration and secret material. This issue is fixed in version 2.5.0.

Severity

8.8 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

SSVC

Exploitation: poc Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-10-09 17:57 UTC

CWE

CWE-312 - Cleartext Storage of Sensitive Information
CWE-598 - Use of GET Request Method With Sensitive Query Strings

Assigner

GitHub_M CNA under the mitre root

CNA scorecard C 72/100 over 7624 records in the last 180 days details

References

3 references

URL	Tags
https://github.com/0xJacky/nginx-ui/security/advi…	x_refsource_CONFIRM
https://github.com/0xJacky/nginx-ui/commit/a3999b…	x_refsource_MISC
https://github.com/0xJacky/nginx-ui/releases/tag/v2.5.0	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
0xJacky	nginx-ui	Affected: >= 2.0.0, < 2.5.0

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-107807",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-09T17:57:25.380922Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-09T17:57:31.880Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://github.com/0xJacky/nginx-ui/security/advisories/GHSA-pvgv-gcp7-v38g"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "nginx-ui",
          "vendor": "0xJacky",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e= 2.0.0, \u003c 2.5.0"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Nginx UI is a web user interface for the Nginx web server. From 2.0.0 until 2.5.0, Nginx UI accepts the Node.Secret master credential through the node_secret query parameter in HTTP and WebSocket authentication paths instead of requiring the X-Node-Secret header. The credential can consequently appear in access logs, proxy logs, browser history, Referer headers, configuration URLs, and deployment environment data. A party that obtains the secret can bypass normal password, JWT, session, and second-factor checks and obtain persistent administrative API access, including access to configuration and secret material. This issue is fixed in version 2.5.0."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-312",
              "description": "CWE-312: Cleartext Storage of Sensitive Information",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-598",
              "description": "CWE-598: Use of GET Request Method With Sensitive Query Strings",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-09T15:04:18.109Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/0xJacky/nginx-ui/security/advisories/GHSA-pvgv-gcp7-v38g",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/0xJacky/nginx-ui/security/advisories/GHSA-pvgv-gcp7-v38g"
        },
        {
          "name": "https://github.com/0xJacky/nginx-ui/commit/a3999bd78a3b97ab22e6b5e9fd478ac57598a954",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/0xJacky/nginx-ui/commit/a3999bd78a3b97ab22e6b5e9fd478ac57598a954"
        },
        {
          "name": "https://github.com/0xJacky/nginx-ui/releases/tag/v2.5.0",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/0xJacky/nginx-ui/releases/tag/v2.5.0"
        }
      ],
      "source": {
        "advisory": "GHSA-pvgv-gcp7-v38g",
        "discovery": "UNKNOWN"
      },
      "title": "Nginx UI: Node Secret Credential Exposure via URL Query Parameter"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-107807",
    "datePublished": "2026-10-09T15:04:18.109Z",
    "dateReserved": "2026-10-08T21:23:59.820Z",
    "dateUpdated": "2026-10-09T17:57:31.880Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

GHSA-PVGV-GCP7-V38G

1. Vulnerability Summary

2. Root Cause Analysis

2.1 Node Secret Accepted as URL Query Parameter

2.2 Node Secret Is a Full Authentication Bypass

2.3 Cluster Configuration Embeds Node Secrets in URLs

2.4 Node Secret Generation Uses UUID

3. Exposure Surface

4. Proof of Concept

Scenario A: Log-Based Secret Extraction

Scenario B: Environment Variable Exposure in Docker/Kubernetes

Scenario C: Referer Header Leak to Third-Party

5. Impact

6. Affected Versions

7. Recommended Fixes

8. Timeline

Citations

CVE-2026-107807 (GCVE-0-2026-107807)

Tags

Sightings

Nomenclature

Related by attack behaviour